DPA case 2020031242 – Complaint Upheld (Iceland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Icelandic school and municipality were found to have improperly withheld some personal data from parents. This is significant because it shows that organizations must fully inform individuals about their data and cannot hide information. The ruling reinforces the right to access personal data.
What happened
The Icelandic DPA upheld a complaint about incomplete data access provided to parents regarding their daughter's information.
Who was affected
Parents seeking access to their daughter's personal data processed by a school and municipality were affected.
What the authority found
The DPA ruled that the school and municipality did not fully comply with the parents' access request, as they withheld some data to protect third-party interests.
Why this matters
This decision highlights the importance of transparency in data access requests. It reminds organizations to ensure they provide complete information while balancing privacy rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complainants had made an access request under Article 15 GDPR to obtain a copy of the personal data that a school and municipality were processing about their daughter and themselves (including, emails between the complainants and the municipality, handwritten points from a parents' meeting, emails between the school and several parents, the report of a study counselor, etc). Following that access request, the defendants provided them with a partial file, and did not inform them of the fact that some data had been withheld to protect the interests of third parties. After realizing that the file was incomplete, the complainants contacted the municipality's data protection officer (DPO) to ask whether some data was not missing. As a result, they received additional data, and were also informed that the school had decided to withhold some data regarding communications with parents of other students, in order to protect the rights and interest of these third parties. Considering that they still had not received all the data they were entitled to, and had not been properly informed about where the data was stored, the complainants lodged a complaint with the Icelandic DPA on 21 March 2021. The DPA decided to conduct an on-site inspection of the municipality office to clarify the matter. On 1 September 2021, the Icelandic DPA rendered its decision after considering the views of each party and the additional information collected during the on-site inspection of the municipality office. Regarding the incomplete nature of the file that was handed to the complainants, the Icelandic DPA stated that, by refusing to disclose emails exchanged between the school and other parents, the defendants had acted in accordance with Article 15(4) GDPR, which provides that "the right to obtain a copy [of one's personal data] shall not adversely affect the rights and freedoms of others". In particular, it had been found that the e-mail communications with parents of other children,
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2020031242 in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2020031242 - Iceland (2021). Retrieved from cookiefines.eu
Last updated: